cvedb.io
CVE-2018-3968
HIGH · CVSS 7
EPSS exploitation probability: 0%
Published 2019-03-21T17:29:00.493 · Last modified 2026-06-17T01:58:08.010

Summary

An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions lack proper FIT signature enforcement, which allows an attacker to bypass U-Boot's verified boot and execute an unsigned kernel, embedded in a legacy image format. To trigger this vulnerability, a local attacker needs to be able to supply the image to boot.

Affected products

denx — u-boot

Does this affect you?

Add your gear to cvedb and we'll alert you only when denx ships something exploited.

Check my exposure →

References

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.